We make two contributions with this paper. First, we formulate intrusion prevention as a problem of multiple stopping. This novel formulation allows us a) to derive properties of an optimal defender policy using results from dynamic programming and optimal stopping; and b) to approximate an optimal policy for a non-trivial infrastructure configuration. Second, we present a reinforcement learning approach to obtain policies in an emulated infrastructure. With this approach, we narrow the gap between the evaluation environment and a scenario playing out in a real system. We also address a limitation of many related works, which rely on simulations solely to evaluate policies [1]}, [2]}, [3]}, [4]}, [5]}, [6]}, [7]}.
